$1.3 billion lost as identity fraud – and greed – saw 57,000 or more seek unearned tax refunds One hundred and fifty people who worked for the Australian Taxation Office (ATO) have been investigated – and some prosecuted – for…
Category: The Register – Security
Crims found and exploited these two Microsoft bugs before Redmond fixed ’em
SAP, Adobe, Intel, AMD also issue fixes as well as Google for Android Patch Tuesday Microsoft fixed 73 security holes in this February’s Patch Tuesday, and you better get moving because two of the vulnerabilities are under active attack.… This…
Just one bad packet can bring down a vulnerable DNS server thanks to DNSSEC
‘You don’t have to do more than that to disconnect an entire network’ El Reg told as patches emerge A single packet can exhaust the processing capacity of a vulnerable DNS server, effectively disabling the machine, by exploiting a 20-plus-year-old…
Just one bad DNS packet can bring down a public DNSSEC server
‘You don’t have to do more than that to disconnect an entire network’ El Reg told as patches emerge A 20-plus-year-old security vulnerability in the design of DNSSEC (Domain Name System Security Extensions) could allow a single DNS packet to…
QNAP vulnerability disclosure ends up an utter shambles
Two new flaws, one zero-day, countless different patches, but everything’s fine! Network-attached storage (NAS) specialist QNAP has disclosed and released fixes for two new vulnerabilities, one of them a zero-day discovered in early November.… This article has been indexed from…
ALPHV blackmails Canadian pipeline after ‘stealing 190GB of vital info’
Gang still going after critical infrastructure because it’s, you know, critical Canada’s Trans-Northern Pipelines has allegedly been infiltrated by the ALPHV/BlackCat ransomware crew, which claims to have stolen 190 GB of data from the oil distributor.… This article has been…
ALPHV blackmails Canadian pipeline and claims it stole 190GB of vital info
Gang going after critical infrastructure because it’s…you know Canada’s Trans-Northern Pipelines has allegedly been breached by the ALPHV/BlackCat ransomware crew, which claims to have stolen 190 GB of data from the oil distributor.… This article has been indexed from The…
Crooks hook hundreds of exec accounts after phishing in Azure C-suite pond
Plenty of successful attacks observed with dangerous follow-on activity The number of senior business executives stymied by an ongoing phishing campaign continues to rise with cybercriminals registering hundreds of cloud account takeovers (ATOs) since spinning it up in November.… This…
Meta says risk of account theft after phone number recycling isn’t its problem to solve
Leaves it to carriers, promoting a complaint to Irish data cops from Big Tech’s bête noire Meta has acknowledged that phone number reuse that allows takeovers of its accounts “is a concern,” but the ad biz insists the issue doesn’t…
Infosys subsidiary named as source of Bank of America data leak
Looks like LockBit took a swipe at an outsourced life insurance application Indian tech services giant Infosys has been named as the source of a data leak suffered by the Bank of America.… This article has been indexed from The…
Korean eggheads crack Rhysida ransomware and release free decryptor tool
Great news for victims of gang that hit the British Library in October Some smart folks have found a way to automatically unscramble documents encrypted by the Rhysida ransomware, and used that know-how to produce and release a handy recovery…
FCC gets tough: Telcos must now tell you when your personal info is stolen
Yep, cell carriers didn’t have to do this before The FCC’s updated reporting requirements mean telcos in America will have just seven days to officially disclose that a criminal has broken into their systems.… This article has been indexed from…
Dutch insurers demand nudes from breast cancer patients despite ban
No photos? No, second operation Dutch health insurers are reportedly forcing breast cancer patients to submit photos of their breasts prior to reconstructive surgery despite a government ban on precisely that.… This article has been indexed from The Register –…
FCC gets tough: Telcos must now tell you when your PII is stolen
Yep, cell carriers didn’t have to do this before The US Federal Communications Commission’s updated reporting requirements mean telecos will have just seven days to officially disclose that a criminal has broken into their systems.… This article has been indexed…
Jet engine dealer to major airlines discloses ‘unauthorized activity’
Pulls part of system offline as Black Basta docs suggest the worst Willis Lease Finance Corporation has admitted to US regulators that it fell prey to a “cybersecurity incident” after data purportedly stolen from the biz was posted to the…
Europe’s largest caravan club admits wide array of personal data potentially accessed
Experts also put an end to social media security updates The Caravan and Motorhome Club (CAMC) and the experts it drafted to help clean up the mess caused by a January cyberattack still can’t figure out whether members’ data was…
Mon Dieu! Nearly half the French population have data nabbed in massive breach
PLUS: Juniper’s support portal leaks customer info; Canada moves to ban Flipper Zero; Critical vulns Infosec In Brief Nearly half the citizens of France have had their data exposed in a massive security breach at two third-party healthcare payment servicers,…
Meet VexTrio, a network of 70K hijacked websites crooks use to sling malware, fraud
Some useful indicators of compromise right here More than 70,000 presumably legit websites have been hijacked and drafted into a network that crooks use to distribute malware, serve phishing pages, and share other dodgy stuff, according to researchers.… This article…
Ivanti discloses fifth vulnerability, doesn’t credit researchers who found it
Software company’s claim of there being no active exploits also being questioned In disclosing yet another vulnerability in its Connect Secure, Policy Secure, and ZTA gateways, Ivanti has confused the third-party researchers who discovered it.… This article has been indexed…
Fortinet’s week to forget: Critical vulns, disclosure screw-ups, and that toothbrush DDoS attack claim
An orchestra of fails for the security vendor We’ve had to write the word “Fortinet” so often lately that we’re considering making a macro just to make our lives a little easier after what the company’s reps will surely agree…